Riskcovery

CVE-2025-48040

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

State
Published
Severity
6.9 Medium
Published
Sep 11, 2025
Updated
Jul 24, 2026
Reserved
May 15, 2025

Read the record on cve.org

Description

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
OTPErlang
  • 3.0.1 and laterAffectedfrom 5.3.3Not affectedfrom 5.2.11.3Not affectedfrom 5.1.4.12Not affected
OTPErlang
  • 17.0 and laterAffectedfrom 28.0.3Not affectedfrom 27.3.4.3Not affectedfrom 26.2.5.15Not affected
  • 07b8f441ca711f9812fad9e9115bab3c3aa92f79 and laterAffectedfrom 7cd7abb7e19e16b027eaee6a54e1f6fbbe21181aNot affectedfrom 548f1295d86d0803da884db8685cc16d461d0d5aNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.